The TenantMigrationAccessBlocker class transitions between several states over the course of a migration. To make it easier to catch bugs, we should add a class / helper method that formally validates the transitions are legal (possibly like the one used by TransactionParticipant). This can replace the ad-hoc invariants currently used for that purpose.